Monorepo Three-Tier Dependency Resolution
Identity field detection (database, auth, payments, aiSdk) uses `allDeps` — a flat merge of all workspace package dependencies. This creates two opposite problems from one design decision:
verdict PASSscore 24 / 24findings 5 (0 risk · 2 debt · 3 obs)duration 35mrejection cycles 0shipped May 26, 2026surface cli
Pipeline timeline
Intent to proven code in 35m across Think, Plan, Build, and Verify.
Think2m
Plan7m
Build9m
Verify6m
Assertion ledger
24 claims, each independently verified. Showing 8 — show all →
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | The census type includes root production dependencies | verified | ok |
| A002 | Census builder populates root production deps from root package.json | verified | ok |
| A003 | ORM package names are exported as a constant | verified | ok |
| A004 | Prisma is recognized as an ORM | verified | ok |
| A005 | Raw database drivers are not classified as ORMs | verified | ok |
| A006 | BaaS packages are not classified as ORMs | verified | ok |
| A007 | Primary package database wins over integration package database | verified | ok |
| A008 | Integration packages do not contaminate project identity | verified | ok |
Findings 5 total
debtpackages/cli/tests/engine/three-tier-detection.test.ts→ scope
A022 uiSystem test is a hasDep proxy — doesn't call detectUiSystem
obspackages/cli/src/engine/scan-engine.ts→ closed
testing field included in three-tier resolution despite spec saying 'stays on allDeps'
debtpackages/cli/tests/engine/three-tier-detection.test.ts→ monitor
resolveThreeTier helper duplicates scan-engine logic — drift risk if engine changes
obspackages/cli/src/engine/scan-engine.ts→ closed
hasDep uses truthy check (||) — empty string version would be treated as absent
obs→ closed
detectAiSdk duplicate eliminated — resolves proof chain finding
Integrity seal
scopesha256:41065fc455570...
contractsha256:3e1618b8a7d72...
plansha256:f48d3a4df2856...
specsha256:0e5c85d784b77...
build-reportsha256:f32a7be6ce909...
build-datasha256:f12936f4da071...
verify-reportsha256:c179fe74d841c...
verify-datasha256:5655ad6ed17f7...
audit cmd$ ana proof audit monorepo-dep-resolution → all hashes match